212bc3ead48049a4a09b9bc2fb3d058800a76d73d82fe345e2db931bd270f2de

Analysis

max time kernel
122s
max time network
159s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

start.html
Size

3KB
MD5

eb71da36f0d9400d3229b24f101f4164
SHA1

7a98423580e88842fc52a60e67ebc6b3ce83c86f
SHA256

3a898bd47fa2ab5662e35a988029b87d12aaf3e824d171cff29157796e138f92
SHA512

31c78bdf0aa7c23cf1acc50f77eef3cade36775d0f097fa87b6444aa997992c9a00a52a3ba2162fbc32f7abb5058ff54195af67aa5f8562507fe3803480570a9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07fa1e27175da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000d9b523c1939e1c8de49da9bb1ab7b0a9c8d1e18a700cf893694d279e28735dc0000000000e80000000020000200000008821e32f163d9d048d8b5f367212cb988a5d33d42ff721d031e5e0093237302790000000df12fc683bd18aaa37ef20e7097f2f51f11dd76808e08d7c7f9b81684800c30492ee862a9ae7be28fc5d2117fe718b7344cf02490318c27136e7a37657634f9487293492430e25d79f9ca24e266c0504b86b68e8fc84b403db8cd395fd54574ddacd568d0cd8198203f275c70531088d7a7bf9db371548df358eff7c69f7bf43b3b0351f7b64285f6021fa4ac5f227ff400000007544e587f3abace78c59db8f2bc875d72673b6b7c96e83100b2d2a0a11e35d608b7fac06d900d98e30edcca1b0bdca8dcefe933059e5d241f75b0009955c9a09	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000022b46a86121919c959bd6ab7ff98336f2a8ba8bf05def90ce479257623a9198c000000000e8000000002000020000000fed273c35bf78a5a1c30860aa9e010e42858900184507585fbaee66e4028166920000000c76894a9d7be8168a0eddfe8eb2b6b0658940fb36b25e2aa1ea5344c14bbad9a400000009ce7ebe619956fe3ffb1d38b496ab6fb5feb131350f142e38889a49c5ba16adb81c6559a81e3201ab5c9f0543f376ccd055a895d1ae56244d896766b946dda02	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416515351"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CF81EF1-E165-11EE-B6BE-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2996	2340	iexplore.exe	28
PID 2340 wrote to memory of 2996	2340	iexplore.exe	28
PID 2340 wrote to memory of 2996	2340	iexplore.exe	28
PID 2340 wrote to memory of 2996	2340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\start.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55fbc2c0bf7e71372ec06109be6c2d5a

SHA1
107af5980ac7786deb2f55fe4f1f82fe5145fc27

SHA256
b92cf7c1240c381277665562877e0748300106f35b2a52f5ece4ce70cd1370d8

SHA512
1a3762fb7e025f6719411e477c23d213e24405ac9a34302a30b568391ed739b012d80de8fbb2b36227ee45c0f0e287186fc342579a7eb932c813f1d8d0cdef45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65f7d4734504a235ae8cfb7ca894a6e4

SHA1
9b439e55ff16f00d728181e5586485250dcd604f

SHA256
5f30d3555bf81d8d6bc2e1e2ad84f7a6aefca644636d95bbd19ffd4eefa720a2

SHA512
247ad8c9d2bc5ef8221a42a4c42ba63f29b69b4b1ae1357485561a19ca65e727a31e7b1e96e3e7e8a61231d33a5ec5133ee8cc4f748e5b9703b881baf9a7e929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e658c8bf8e78a787723e8bb88a9611

SHA1
9de1b404cf4ecf80a142730c78738c36e261aa3f

SHA256
fb8ce10007fd8c968ab709424aa75dfb18b0cb24eb3b0a6be01bff26b0381ebf

SHA512
52ed9fd62a8779decca76913912bcf31ef3d9a339eb7e56ab908d16b3f1d49116899d5681c2302db430cbc003fae7c186ef3bc49fa9020595a95162398748b39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c17a81ccfe7ef81611c8af19ce65578

SHA1
0bb7cedd68a8fa5cd4cf953bcff34911c0017987

SHA256
f8adfa622f0d8b66a8f2aafa4e2fc92fa916e79cbdafbfa1291c05038bb12880

SHA512
df13b6a36b315cdd6232d24870f6659da374a0b9b64e8703b1f189badef986360f763edbf0dc2ce9600cf6030c8c0ea76f428f2760973c8aaea15be73f9a2996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a7a0f9ec5c26764d94833c7966bc7f0

SHA1
f704be265436ad43b8e87e27a5091aa86c13141b

SHA256
49d5dd8068f849ce41b0e09ac49a2cd48bdbf92505572b44590f0ea984b4e978

SHA512
40a13d30a70074b3a20bea07645aacb29ab7fbf9aae4f03e4aea5d52d81c59a983cf416533dd99b7dd207e506e95e346cead7353c80d19962ea4022cfeba0728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da6a705e5f8893435ed513421359d9bf

SHA1
5139c3b58e709b61542a47a7942a18a4a4e6f77e

SHA256
e45f4f52b34314d65eeb827c117a533370e50facd4996e2d0baf6b7e06f4dbc4

SHA512
b8e5d67f2ae8033e5068258919060ea586fdedb0195b3ceefa839e12890a278e89405a06fd0974025cb2be509088bf8026fce96bfc7d40ee51402867805d6711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f223be96268a423968461a02bfc9548

SHA1
e45ce683c02e43deb03e0a3472075fae8f6f1602

SHA256
20d1af447d328cfab21590600fbf10133e94964ebbe2816429ac184874f3e980

SHA512
f085321536bdf06eda38f3d2051e2a7f1cc70f4906761054adc970bb1eeb78a63be9f0dee7d0e084d6f2a7b7a65c6f5bf56782d0055303a6e6cd5191f10bc67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e003ae9cf569179dd0f4c1aa960b93c

SHA1
61daf473167a2d953564664f3158b140a5092a25

SHA256
8068aa88cc0f58d71a2fe12eb6b6a89e3f1997350b30d7cb69e2d6b478fe44db

SHA512
34731935f86f9f3aa7f039859cd1909511de58ba67bb13217ac6b0f228de23f4079ccfb29f7c57662af7bb1b64abd1d13b2cc3f2a7adbdeb6679a2333613d4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbfc8b8ee114b14b7e01ac03fabae390

SHA1
7db778dbaeb656ee2c8d827bcde3039ce855883f

SHA256
9bfbb05f92a17312a957918e8066a1836dae09fab3c462155bff6b8603664718

SHA512
14b9a4db81e26c79b2ff8b01c41d5fc64795a5becdb5bee563dd4b5e44209fd393a91b7e3132364a793fc1a1b739d2bade887a16c41e44f4d70c3d8c6b6dc78d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9292774a2cd52e58f312240bf7979f0

SHA1
57ce74ab8ed791683da04cb8efcc50157b4dcfa2

SHA256
421ffd6a6ac947c770ff27d4f1139e7ab0d889931388e555ef3ed58f7c0194ac

SHA512
19ca0f78098fd9f4f2e1fcd0dddac9ea4863d078c080030f229c84f194d311c68b9078a607046e3d095d23ae4b032abf527340cceac8f72b162e45da46bd0b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8163.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8270.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8283.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit